Explainer
Per-app proxy on macOS: how it works, and when you actually need one
macOS 13+ · Apple Silicon and Intel · Updated 2026-08-28
What "per-app" actually means
macOS proxy settings live on the network service: one HTTP proxy, one SOCKS proxy, applied to everything using that connection. A per-app proxy moves the decision one level down, to the point where a connection is created, where the operating system still knows which process is asking. That single extra fact — who is asking — is what makes the difference.
What a router like this can decide on
- The application that opened the connection, chosen from a list by its real icon rather than a typed process name.
- The destination: a domain, a wildcard, an IP address or a whole subnet.
- The protocol, including whether UDP and QUIC should be proxied, forced back to TCP, or left direct.
- The action itself: direct, through a chosen upstream, or blocked outright — cutting the application off the network entirely.
- The network you are currently on, so the whole rule set can change when you move.
What it cannot do
It is worth being blunt about the limits, because they decide whether this category of tool is right for you at all:
- It does not give you a proxy. You supply the upstream — a corporate proxy, a staging gateway, a local client, an endpoint you rent. Without one, there is nothing to route to.
- It does not make you anonymous. Where your traffic ends up is entirely determined by the upstream you chose.
- It cannot route traffic that never reaches the network stack as a normal connection — a small number of system-level services behave this way by design.
The part people underestimate: being able to explain a decision
Once you have more than about five rules, the interesting question stops being "can it route this?" and becomes "why did it route that?". A rule set that cannot answer this turns into guesswork every time something behaves oddly. Every connection can be expanded to show the matched rule and the path taken, and a dry-run tester answers the same question ahead of time, without sending a packet.
Where to go next
If you already know the shape of your problem, these walk through it directly:
FAQ
Do I need a per-app proxy at all?
Only if the system-wide switch is the wrong shape for your problem. If turning the proxy on breaks something else, or if some apps ignore the system setting, or if different apps need different upstreams — that is when per-app routing is the right tool. Otherwise the built-in setting is enough.
Does it slow things down?
The routing decision itself is a rule lookup per new connection and is not something you can feel. What you do feel is the upstream you chose: a distant proxy adds its own latency, and traffic you leave on Direct has none of that overhead — which is part of why routing selectively is faster than routing everything.
Can rules follow me between office, home and hotspot?
Yes. Networks are identified by SSID for Wi-Fi, and by gateway MAC plus subnet for wired connections — which is what makes 'office cable' and 'home cable' distinguishable. Bind a profile to a network and it is restored whenever you return to it.
Is a per-app proxy the same thing as a VPN?
No, and the difference matters. A VPN service provides you with servers and an encrypted tunnel to them. A per-app proxy router provides neither — it only decides which of the endpoints you already have each application should use. ProxyRouter has no servers, no node list and no network of its own.
ProxyRouter comes with a free full-feature trial, no card required. You bring your own SOCKS5 or HTTP upstream — a corporate proxy, a staging gateway, or a port on localhost. We do not provide or resell proxy servers.
Related
- Block an app from the internet on macOS
- How to use a SOCKS5 proxy on macOS
- Make git, curl and npm use a proxy on macOS
- When a Mac app ignores the system proxy
- Route one app through a proxy on macOS
- Keep specific apps off a VPN on macOS
- Proxy UDP and QUIC traffic on macOS
- Proxifier alternative for Mac